tachyon-browser — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tachyon-browser (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to control the k3s-hosted Chromium CDP gateway at:
browser-cdp.intra.quantum-box.com:9222The gateway creates one Chromium Pod per /sessions/<session_id> and exposes it as a CDP WebSocket URL. It is intended for Cloudflare Mesh / WARP clients, such as Sakura VPS Claude Code, local Codex, and local automation.
ws://.../sessions/<id> CDP URL to agent-browser.http://.../sessions/<id> to agent-browser; its HTTP CDP handling drops the path and falls back to the shared root browser.agent-browser --session when possible. This avoids local daemon confusion.[A-Za-z0-9._-]{1,96}.Use a named session when the user wants to reconnect to the same browser during a task.
SESSION_ID="sakura-job-001"
agent-browser \
--cdp "ws://browser-cdp.intra.quantum-box.com:9222/sessions/${SESSION_ID}" \
--session "${SESSION_ID}" \
open https://example.comContinue using the same SESSION_ID for subsequent commands:
agent-browser \
--cdp "ws://browser-cdp.intra.quantum-box.com:9222/sessions/${SESSION_ID}" \
--session "${SESSION_ID}" \
snapshot -iDelete the remote browser when done:
curl -sS -X DELETE "http://browser-cdp.intra.quantum-box.com:9222/sessions/${SESSION_ID}" | jq .Use a temporary session when the user does not care about the session id.
SESSION_JSON="$(curl -sS -X POST http://browser-cdp.intra.quantum-box.com:9222/sessions)"
SESSION_ID="$(printf '%s' "$SESSION_JSON" | jq -r .session_id)"
CDP_WS="$(printf '%s' "$SESSION_JSON" | jq -r .cdp_ws_url)"
agent-browser \
--cdp "$CDP_WS" \
--session "$SESSION_ID" \
open https://example.com
curl -sS -X DELETE "http://browser-cdp.intra.quantum-box.com:9222/sessions/${SESSION_ID}" | jq .Prefer the bundled helper when doing one-off checks. In Claude Code, the plugin's bin/ directory is added to PATH, so use remote-browser directly:
remote-browser \
--temporary \
--cleanup \
-- open https://example.comWhen using this skill folder directly outside a Claude plugin install, resolve the script path relative to this skill directory:
scripts/remote-browser.sh \
--temporary \
--cleanup \
-- open https://example.comUse a named browser:
scripts/remote-browser.sh \
--session-id sakura-job-001 \
-- open https://example.comCreate a temporary session and keep it:
scripts/remote-browser.sh \
--temporary \
--keep \
-- open https://example.comThe script prints the remote session_id and cdp_ws_url to stderr before running agent-browser.
curl -sS http://browser-cdp.intra.quantum-box.com:9222/readyz
curl -sS http://browser-cdp.intra.quantum-box.com:9222/sessions | jq .
curl -sS http://browser-cdp.intra.quantum-box.com:9222/sessions/<session_id>/json/version | jq .The session list includes last_access_at, idle_seconds, idle_timeout_seconds, and ttl_seconds.
For Playwright or direct CDP clients, connect to the WebSocket URL:
import { chromium } from 'playwright';
const browser = await chromium.connectOverCDP(
'ws://browser-cdp.intra.quantum-box.com:9222/sessions/sakura-job-001',
);http://.../sessions/<id> instead of ws://.../sessions/<id>.agent-browser state, close it with agent-browser --session <name> close and reconnect with the WebSocket CDP URL.remote-browser is not found in Claude Code, verify the plugin is enabled and run /reload-plugins./readyz.fonts-noto-cjk; the current gateway template installs it at startup.--user-data-dir.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.